Commit Graph

79311 Commits

Author SHA1 Message Date
Leszek Swirski
c5dc2fc9c1 [mjsunit] Make Array deepEquals respect holes
Don't let holes compare equal to undefined, to avoid tests accidentally
succeeding when operating on the wrong holeyness.

Change-Id: I5fe1eea8b3e718389b46d542be45cca578a1080c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4091024
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84769}
2022-12-10 13:19:33 +00:00
v8-ci-autoroll-builder
292c0a637a Update V8 DEPS (trusted)
Rolling v8/build: 2c6fbff..3d4b0c1

Rolling v8/buildtools: 4fb9b31..202b660

Rolling v8/buildtools/third_party/libc++/trunk: e4e39ce..5239965

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/562809c..2f1cf61

Rolling v8/third_party/depot_tools: d259b31..a964ca1

Rolling v8/third_party/fuchsia-sdk/sdk: version:10.20221207.3.1..version:11.20221209.0.1

Rolling v8/tools/clang: 6d77ba2..3344dd8

Change-Id: I31da71ca758f8baf8981dd0a2e36447ce3dac7c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4094834
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#84768}
2022-12-10 04:12:27 +00:00
Shu-yu Guo
08e95d81d5 [rab/gsab,api] Add v8::BackingStore::MaxByteLength
I originally thought MaxByteLength would only be needed for
v8::ArrayBuffer and v8::SharedArrayBuffer, but it is also needed on
v8::BackingStore.

In particular, blink uses Mojo to serialize ArrayBuffers' contents via
v8::BackingStore when doing cross-process postMessage.

Bug: chromium:1396361, v8:11111
Change-Id: I86d44829175ad760fb43294d386483a16044fc3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4090708
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84767}
2022-12-09 22:45:18 +00:00
Choongwoo Han
2dcb0a1a1e Fix Array.toReversed to create properties for holes
Array.toReversed always creates properties even for holes, but the
optimization paths for HOLEY_* arrays did not respect the spec. This CL
fixes the fast paths to set `undefined` value instead of the hole.

Bug: chromium:1395672
Change-Id: I51584829caf312a1864f93928315782bb120ee14
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4081689
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Choongwoo Han <choongwoo.han@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#84766}
2022-12-09 18:00:55 +00:00
Nico Hartmann
b3ffda44f2 [turboshaft] Introduce new Turboshaft type system
Bug: v8:12783
Change-Id: Id5d3ce17f0dc8cec1b2b257585290bed72dd9fd9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4057111
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84765}
2022-12-09 17:41:29 +00:00
Anna Henningsen
ccddea063b [api] mark readonly usage of StartupData as const
This doesn’t have much practical effect, since the actual
byte contents referred to by `StartupData` are already marked
`const`, but adding the qualifier communicates more clearly
to users that V8 does not perform modifications on the object.

Practically speaking, this also allows for cases in which the
startup data is included as readonly data in the current executable
without requiring a `const_cast`.

Refs: https://github.com/nodejs/node/pull/45786#discussion_r1043489245
Change-Id: I53075ebb493c3617e470decb601b803f5294848d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4089203
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84764}
2022-12-09 16:58:44 +00:00
Clemens Backes
748e6d7c45 [x64] Refactor representation of {Operand}
Make the separation between Operands pointing to Label locations and
standard memory operands more clear.
Also provide a separate method for emitting "label operands", so this
does not get inlined everywhere (label operands are used much less often
than memory operands).

R=jkummerow@chromium.org

Bug: v8:13570
Change-Id: I3482598cbf47eea878e06acc1ce2465325a597e0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4088644
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84763}
2022-12-09 16:44:20 +00:00
Seth Brenith
2635ba5a7f Make translation arrays faster to read
My previous change https://crrev.com/c/4071249 reduced the size of
translation arrays, but caused substantial speed regressions for code
that needs to read those arrays. This is because each translation could
use MATCH_PREVIOUS_TRANSLATION instructions to indicate areas where it
was unchanged from the preceding translation, but that preceding
translation might also use MATCH_PREVIOUS_TRANSLATION because it was
similar to its preceding translation, and so forth up to the limit
imposed by kMaxLookback.

This change is a proposal to fix the decoding speed while keeping most
of the size benefit from the previous change, by imposing a rule that
the "previous" translation referred to by a MATCH_PREVIOUS_TRANSLATION
instruction must not also use MATCH_PREVIOUS_TRANSLATION. A simple way
to accomplish this would be to decrease kMaxLookback to 1 and keep the
rest of the encoder unchanged, but we can do somewhat better by letting
several translations in a row refer to the same "basis" translation, as
long as they're successfully finding matching content.

Total size of translation arrays generated in an Octane run:
- Before my previous change: 2.6 MB
- Current code (kMaxLookback=10): 1.1 MB
- This CL: 1.4 MB
- Setting kMaxLookback=1: 1.8 MB

Bug: chromium:1399556, chromium:1396229
Change-Id: I077da8aae93ec667ff587a1db1bff483de76cf34
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4089944
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#84762}
2022-12-09 15:47:29 +00:00
Qifan Pan
753584c74b [turbofan] Inline BigInt Constructor for Integral32 input
This CL introduces two JS operators JSToBigInt and
JSToBigIntConvertNumber and one simplified operator
Integral32OrMinusZeroToBigInt.

- BigInt constructors are lowered to JSToBigIntConvertNumber in the
  inlining phase.
- JSToBigIntConvertNumber is replaced with
  Integral32OrMinusZeroToBigInt if the input is typed as Integral32
  in typed lowering.
- In simplified lowering, Integral32OrMinusZeroToBigInt is lowered
  to conversion to word64 accordingly.
- If the input is not Integral32 or BigInt, JSToBigIntConvertNumber
  is lowered to a builtin call in generic lowering.

Bug: v8:9407
Change-Id: I8539d742e82cce515bd9350797f5f9b0876ee6f2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4055670
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Qifan Pan <panq@google.com>
Cr-Commit-Position: refs/heads/main@{#84761}
2022-12-09 15:08:34 +00:00
Dominik Inführ
458cda96fe Revert "[heap] Iterate promoted pages during sweeping"
This reverts commit 1e3dd39d09.

Reason for revert: Causes failures with --shared-string-table

https://bugs.chromium.org/p/chromium/issues/detail?id=1399489
https://bugs.chromium.org/p/chromium/issues/detail?id=1399491
https://bugs.chromium.org/p/chromium/issues/detail?id=1399488
https://bugs.chromium.org/p/v8/issues/detail?id=13574

Original change's description:
> [heap] Iterate promoted pages during sweeping
>
> Promoted pages are iterated to record slots containing old to new and
> old to shared references. This takes a significant amount of time during
> the atomic pause.
> Instead we offload this task to the concurrent sweepers, record slots to
> a local cache, and merge it when finalizing sweeping.
>
> Array buffer sweeping depends on iteration of promoted pages, so it is
> frozen until iteration is done.
>
> See design doc at https://docs.google.com/document/d/1JzXZHguAnNAZUfS7kLeaPVXFfCYbf5bGCtyKgyiMDH4/edit?usp=sharing
>
> Bug: v8:12612
> Change-Id: Icdc79a7a70c53352e3a1b3961cfe369e8563b65b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4062041
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Auto-Submit: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84706}

Bug: v8:12612
Change-Id: I4ed4a6ad954cb294b569c94b4d8ea25a0956a223
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092734
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84760}
2022-12-09 14:53:05 +00:00
Dominik Inführ
a44a164e6d Revert "[heap] Fix typo in pretenuring"
This reverts commit 350f57281a.

Reason for revert: Causes failures with --shared-string-table

https://bugs.chromium.org/p/chromium/issues/detail?id=1399489
https://bugs.chromium.org/p/chromium/issues/detail?id=1399491
https://bugs.chromium.org/p/chromium/issues/detail?id=1399488
https://bugs.chromium.org/p/v8/issues/detail?id=13574

Original change's description:
> [heap] Fix typo in pretenuring
>
> PretenturingHandler -> PretenuringHandler
>
> Change-Id: If25e8be65dc6050688213fbb481751d7cbcd0e8b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4085984
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84727}

Change-Id: Ib9765f459b7f7ee9a320998709a6eecd4beece1b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092495
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84759}
2022-12-09 13:55:40 +00:00
Al Muthanna Athamina
5eb7f8e8b4 Remove nexus7 bot flag
Bug: chromium:1399445
Change-Id: I04c78bc41466010dc1584f317d4d7080ee9e03e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4091547
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84758}
2022-12-09 13:37:51 +00:00
Dominik Inführ
5b9cc13eb5 Revert "[heap] Adjust pretenuring heuristic for MinorMC"
This reverts commit a614ccb8f7.

Reason for revert: Causes failures with --shared-string-table

https://bugs.chromium.org/p/chromium/issues/detail?id=1399489
https://bugs.chromium.org/p/chromium/issues/detail?id=1399491
https://bugs.chromium.org/p/chromium/issues/detail?id=1399488
https://bugs.chromium.org/p/v8/issues/detail?id=13574

Original change's description:
> [heap] Adjust pretenuring heuristic for MinorMC
>
> MinorMC needed to process pretenuring feedback both after sweeping and
> at the end of the atomic pause, despite having no new feedback at the
> end of the atomic pause, because the heuristics didn't hold after
> sweeping. This CL adjusts the heuristics for MinorMC so that processing
> twice is no longer needed.
>
> Bug: v8:12612
> Change-Id: I4d3ebaeaa6e7868bcdcae6fbdb3bcecb0ebcb8bf
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4085983
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84730}

Bug: v8:12612
Change-Id: I291de288cb1dff451197fc222ede49b428893fe0
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4089968
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84757}
2022-12-09 13:00:13 +00:00
Simon Zünd
fb02c04d48 [debug] Only pause once when we throw in an async generator
Similar to the `AsyncFunctionReject` builtin, the
`AsyncGeneratorReject` should also mark the promise rejection as a
non-debuggable event.

That is because the initial throw that causes the generator rejection
downstream alreay triggered the debuggable event.

We can re-use one of the existing tests as a regression test here:
If we wait for the Runtime.evaluate promise to resolve after the first
pause, we ensure that we already paused once. The test in its current
form swallowed the second pause implicitly by disabling the debugger.

R=bmeurer@chromium.org

Bug: chromium:1270780
Change-Id: I97ab08934804fefd097e9bd01081469da5379154
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4084925
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84756}
2022-12-09 12:49:29 +00:00
Dominik Inführ
26aef2d0f6 Revert "[heap] Fix crash in promoted pages iteration"
This reverts commit e5dbd05dcf.

Reason for revert: Causes failures with --shared-string-table

https://bugs.chromium.org/p/chromium/issues/detail?id=1399489
https://bugs.chromium.org/p/chromium/issues/detail?id=1399491
https://bugs.chromium.org/p/chromium/issues/detail?id=1399488
https://bugs.chromium.org/p/v8/issues/detail?id=13574

Original change's description:
> [heap] Fix crash in promoted pages iteration
>
> Iterating promoted pages uses a snapshot of the allocated pages to avoid
> using locks (which locally resulted in regressions). Large pages may
> have been freed between taking the snapshot and concurrent sweeping.
> If that page is found by LookupChunkContainingAddress as the closest
> page, we will try to access it and crash.
>
> Fix by refresshing the snapshot after all pages have been freed.
>
> Bug: v8:12612, chromium:1399331, chromium:1399328, chromium:1399330
> Change-Id: I01a1dbcb9efde3a34a99d01260b0529dcf04c37a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4088363
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84740}

Bug: v8:12612, chromium:1399331, chromium:1399328, chromium:1399330
Change-Id: Id7e4c057493478956108e4ae4f28ca91cc20f406
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092594
Auto-Submit: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#84755}
2022-12-09 12:46:07 +00:00
Clemens Backes
068536f109 [wasm] Remove thread timings (CPU time)
On Mac, we spend around 30% of lazy compile time in {ThreadTicks::Now}.
On Linux it's less severe, but still around 10%.
That's too much overhead for measurements that only show up in UKM, so
remove that.

The unused fields will be removed from the UKM events after the plumbing
on the chromium side has been removed.

R=ahaas@chromium.org, mlippautz@chromium.org
CC=​ecmziegler@chromium.org

Bug: v8:13565
Change-Id: I2dad88d899482801888940499d2d1761ff075578
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4078966
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84754}
2022-12-09 12:11:22 +00:00
Jaroslav Sevcik
f4fb8fc1f7 [inspector] Introduce debugger session stop API
We introduce V8InspectorSession::stop API to enable safe
detach from the session. In particular, after calling 'stop',
the session will leave any instrumentation pause it might
be in and disarm all its instrumentation breakpoints.

This is useful when the session disconnect request is registered
on V8 interrupt (so it is unsafe to disconnect at that point),
and the execution should first get to the message loop
where the disconnect can be handled safely.

Bug: chromium:1354043
Change-Id: I3caab12a21b123229835e8374efadc1f4c9954c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4085143
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84753}
2022-12-09 12:08:58 +00:00
Toon Verwaest
f3c20276ed [compiler] Use CheckIf instead of DeoptimizeIf to fix the framestate
Bug: chromium:1399695
Change-Id: Id2aae902d1ce483b4d0a1e4953074a7539cf7058
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092264
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84752}
2022-12-09 12:07:48 +00:00
Nico Hartmann
1d733b97a2 Revert "[static-roots] Allow creating isolates from existing r/o snapshot"
This reverts commit 331c577e1d.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20debug%20-%20single%20generation%20-%20builder/9912/overview

Original change's description:
> [static-roots] Allow creating isolates from existing r/o snapshot
>
> This adds the ability to create an isolate from scratch, except the
> read only roots, which are initialized from a read_only_data snapshot.
> To do this we split the heap setup in a read/only part and the rest.
> The goal of these changes is to later support writing serializer tests,
> even if the read only roots are static and have to be loaded from a
> fixed snapshot.
>
> Bug: v8:13466
> Change-Id: I078695b95710e5281da013ca0c08af0e153b4725
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4037271
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Olivier Flückiger <olivf@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84750}

Bug: v8:13466
Change-Id: I91512140abb98993578d27e65e6080e1d3f317e6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4089967
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84751}
2022-12-09 12:06:43 +00:00
Olivier Flückiger
331c577e1d [static-roots] Allow creating isolates from existing r/o snapshot
This adds the ability to create an isolate from scratch, except the
read only roots, which are initialized from a read_only_data snapshot.
To do this we split the heap setup in a read/only part and the rest.
The goal of these changes is to later support writing serializer tests,
even if the read only roots are static and have to be loaded from a
fixed snapshot.

Bug: v8:13466
Change-Id: I078695b95710e5281da013ca0c08af0e153b4725
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4037271
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84750}
2022-12-09 11:43:52 +00:00
Nikolaos Papaspyrou
710f2a4da2 Revert "[heap] Fix conservative stack scanning for client isolates"
This reverts commit 36bac1bcae.

Reason for revert: This possibly caused clusterfuzz issues and test flakiness.

Original change's description:
> [heap] Fix conservative stack scanning for client isolates
>
> With this CL, the context of stacks corresponding to all client isolates
> are saved, so that conservative stack scanning can be used correctly
> during a shared garbage collection. This happens:
>
> 1) in Heap::PerformSharedGarbageCollection, for the stacks of the shared
>    isolate and the initiator;
> 2) when an isolate's main thread is waiting in a safepoint; and
> 3) when an isolate's main thread is parked.
>
> Bug: v8:13257
> Change-Id: I9ff060f2c0c1ec12977c70d67d65d9c543e2d165
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4027210
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84712}

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:13257
Change-Id: I7eb50b24243084d45b3f1bcc37a559b9f92e0318
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092363
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84749}
2022-12-09 10:50:35 +00:00
Al Muthanna Athamina
fe89c47a68 [test] Mark slow tests as slow on debug mode
Bug: v8:13572
Change-Id: Ib23cfc4c3b69ffc7c89d0dde47323a03980452f0
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092223
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84748}
2022-12-09 10:24:47 +00:00
Omer Katz
825915a75c [heap] Replace ZapCode in Sweeper with an atomic variant
Resolve a data race between concurrent sweeping and writing fillers by
the main thread.

Bug: v8:13554, v8:12612
Change-Id: I00bbceca92b4729b2d2bb32be0916a981cfde3e6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4084762
Auto-Submit: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84747}
2022-12-09 10:01:59 +00:00
v8-ci-autoroll-builder
bfb41bd6ee Update V8 DEPS (trusted)
Rolling v8/build: e3833ca..2c6fbff

Rolling v8/buildtools: 71c674d..4fb9b31

Rolling v8/buildtools/third_party/libc++/trunk: a9779c1..e4e39ce

Rolling v8/buildtools/third_party/libc++abi/trunk: f46bba9..25a3d07

Rolling v8/third_party/fuchsia-sdk/sdk: version:10.20221207.2.1..version:10.20221207.3.1

Rolling v8/tools/clang: 72ab320..6d77ba2

Change-Id: Iad0f45ed412bfe0d201485218731eb4050281ba9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4091444
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#84746}
2022-12-09 04:09:15 +00:00
Choongwoo Han
517cd16355 Initialize with zeros for Array.of
The last CL created an array with length zero and enough capacity, and let FastCreateDataProperty to append values. But, there are unnecessary checks in FastCreateDataProperty when appending values. Thus, it's more efficient to create an array filled with smi zero, and fill the values.

Bug: chromium:1395728
Change-Id: Ibe52c688c260637993983ab25f069ee80b212895
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4086126
Commit-Queue: Choongwoo Han <choongwoo.han@microsoft.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84745}
2022-12-09 01:43:41 +00:00
Deepti Gandluri
f5fc2d7fe2 [wasm-relaxed-simd] Implement Dot add instructions on x64/ia32
Bug: v8:12284
Change-Id: Ieb92206cb9b2df296bd9ba1ef88d1183752c4bc4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3866610
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84744}
2022-12-09 01:26:26 +00:00
Deepti Gandluri
aa187e701f Cleanup src/compiler/backend OWNERS
Change-Id: If524a80f87835d05e8cf9f9f840263ba17d1a060
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4087507
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84743}
2022-12-09 00:51:43 +00:00
Milad Fa
3aebd8bef0 PPC[liftoff]: Implement simd swizzle
Change-Id: Ie4e98b28eab8cdf90847197345140e9f3f8bdf79
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4089484
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Reviewed-by: Vasili Skurydzin <vasili.skurydzin@ibm.com>
Cr-Commit-Position: refs/heads/main@{#84742}
2022-12-08 22:10:38 +00:00
Shu-yu Guo
1f306a9666 [rab/gsab] Do not optimize objects in shared space as prototypes
Bug: chromium:1393515, v8:12547
Change-Id: I6d0a7c32cf367976524eec56b824600eecc911ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4086127
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84741}
2022-12-08 21:36:31 +00:00
Omer Katz
e5dbd05dcf [heap] Fix crash in promoted pages iteration
Iterating promoted pages uses a snapshot of the allocated pages to avoid
using locks (which locally resulted in regressions). Large pages may
have been freed between taking the snapshot and concurrent sweeping.
If that page is found by LookupChunkContainingAddress as the closest
page, we will try to access it and crash.

Fix by refresshing the snapshot after all pages have been freed.

Bug: v8:12612, chromium:1399331, chromium:1399328, chromium:1399330
Change-Id: I01a1dbcb9efde3a34a99d01260b0529dcf04c37a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4088363
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84740}
2022-12-08 20:33:29 +00:00
Toon Verwaest
54256360ff [runtime] Don't stay const on store to field
This was a slightly overzealous optimization that ended up being more
tricky than expected without measurable value on the benchmarks (as far
as we know). Let's try to remove it and see whether an important
benchmark notices.

Bug: chromium:1385941
Change-Id: If2e81f6cb6758f9c373e7c2c8beaa308ed323f93
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4088624
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84739}
2022-12-08 17:52:22 +00:00
Marja Hölttä
7bcac055b5 [ic] Fix printing GlobalIC handlers
Change-Id: I585d23ed5367c20838aa856b68c1ef7d776c18c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4078985
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84738}
2022-12-08 16:34:33 +00:00
Maya Lekova
42ef178c3d [turboshaft] Port control flow operations from CommonOperatorReducer
The following operations are reduced in BranchEliminationReducer:
 - Return
 - Select
 - Phi
 - PendingLoopPhi
 - merge blocks

Bug: v8:12783
Change-Id: I76f0bf23b94292bb045b2e7d441425c5483fce65
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4055896
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84737}
2022-12-08 16:17:34 +00:00
Liviu Rau
46efa1b1c8 [resultdb] Make suffixes more distinguishable
Test ids would get an uniform format between different kinds of tests:
prefix//test_id//suffix

 - prefix:
   - empty for regular tests
   - or 'special test' token, as in 'numfuzz'
 - test_id is the full name of the test as generated by test runner:
   - suite_name/path/to/actual/test_name
 - suffix is anything a test runner processor might want to add to the name:
   - numfuzz processor will add 'analysis' of a numeric value
   - variant processor will add the variant name

Bug: v8:13316
Change-Id: Ied8f958173f82d8e26c62e39ccc21167ca2928ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4084763
Commit-Queue: Liviu Rau <liviurau@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84736}
2022-12-08 15:38:51 +00:00
Darius M
ada6f41e91 [maglev][arm64] Implement first Float64 operations
Bug: v8:7700
Change-Id: Ib2d9d0cab90042e2b425f56da8022b25b94c4805
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4082208
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84735}
2022-12-08 15:31:54 +00:00
Milad Fa
73801dac2f PPC[liftoff]: Implement simd fp qfma ops
Change-Id: I4faac2355eb6d84a33674fd47bb2f728ace2ccb9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4086423
Reviewed-by: Vasili Skurydzin <vasili.skurydzin@ibm.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#84734}
2022-12-08 15:09:17 +00:00
Matthias Liedtke
c2a1261355 [wasm-gc] Add new br_on_cast_fail variant taking a heap type immediate
Adds new `br_on_cast_fail <branch depth> <heap type>` instruction
with opcode 0xfb43.
The instruction branches if the cast fails. `null` is treated as a cast
failure (meaning the branch is taken).
The heap type may be any concreate heap type index or an abstract
type like `(ref null eq)`.

Bug: v8:7748
Change-Id: I97a78d6d0872703ab825016cab4e737f8f79995f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4084981
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84733}
2022-12-08 14:53:37 +00:00
Al Muthanna Athamina
bf17a2c78f Doubling shards for slow tests on V8 Linux(64) - debug
Bug: v8:13572
Change-Id: I83535b54ecaa26009076602be06908705d2836c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4088503
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84732}
2022-12-08 14:42:17 +00:00
Thibaud Michaud
d9aa68e850 [heap][wasm] Scan wasm inactive stacks
Wasm stack switching breaks the expectations of the unified V8/C++
heap by breaking the stack into multiple segments. To fix this:

- Store a list of interesting inactive stacks in the heap's Stack object
- When wasm switches stack, update this list, and also update the stack
  start pointer
- Change {Stack::IteratePointers} to also visit pointers in the current
  list of inactive stacks

R=nikolaos@chromium.org,jkummerow@chromium.org
CC=​​irezvov@chromium.org

Bug: v8:13493
Change-Id: Ieafeb89da31325e542e67403b6dc66c28d3be2fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4081126
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84731}
2022-12-08 14:24:37 +00:00
Omer Katz
a614ccb8f7 [heap] Adjust pretenuring heuristic for MinorMC
MinorMC needed to process pretenuring feedback both after sweeping and
at the end of the atomic pause, despite having no new feedback at the
end of the atomic pause, because the heuristics didn't hold after
sweeping. This CL adjusts the heuristics for MinorMC so that processing
twice is no longer needed.

Bug: v8:12612
Change-Id: I4d3ebaeaa6e7868bcdcae6fbdb3bcecb0ebcb8bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4085983
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84730}
2022-12-08 13:15:22 +00:00
Victor Gomes
5d7b57bd29 [maglev][arm64] AssertStackSize
Bug: v8:7700
Change-Id: Id3874b55790dd26cc2da4583fbc00ea39e8b1c8a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4084765
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84729}
2022-12-08 13:11:02 +00:00
Manos Koukoutos
ba6be821c9 [wasm-gc] Change MatchesSignature to use canonical types
Specifically, the methods in {WasmJSFunction} and {WasmCapiFunction}.
Drive-by:
- Fix a bug in {WasmCapiFunction::GetSignature}.
- Fix a bug in wasm-module-builder.js.

Bug: v8:7748
Change-Id: I7408d07766536ed37f23b97ad210212b986412bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4079097
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84728}
2022-12-08 12:38:41 +00:00
Omer Katz
350f57281a [heap] Fix typo in pretenuring
PretenturingHandler -> PretenuringHandler

Change-Id: If25e8be65dc6050688213fbb481751d7cbcd0e8b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4085984
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84727}
2022-12-08 12:36:30 +00:00
Victor Gomes
6b3ab95d35 [codegen] Adding victorgomes to OWNERS
Change-Id: I5abecd9ae018e7add14eab02073ac6511804e359
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4078907
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84726}
2022-12-08 11:39:47 +00:00
George Wort
d5c6b928ad [turbolizer] Remove tslint:recommended so that presubmit can be run
TSLint has been deprecated and so the presubmit script will not
run because of tslint:recommended. Removing this allows the
explicit rules to be run but does not properly fix the use of
TSLint. Also fix the issues that do not pass the linter.

Bug: v8:7327
Change-Id: I9f463ba9520ee2caa4141b21b81fd15012afedff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4085145
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: George Wort <george.wort@arm.com>
Cr-Commit-Position: refs/heads/main@{#84725}
2022-12-08 11:16:29 +00:00
Victor Gomes
c690be58b1 [maglev] Force arguments to apply() be a tagged value
When reducing the apply() builtin, we should force the arguments
to be tagged.

Bug: v8:7700
Fixed: chromium:1394787
Change-Id: Ic62ea1dcf669a271f9ab20454b70dbb9374f166f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4086544
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84724}
2022-12-08 11:12:42 +00:00
Victor Gomes
fd3112b912 [maglev] Fix early return in MaterialiseValueNode
When we split MaterialisedValueNodes to x64 and arm64, we
changed a bit the logic and we should return early in case
of a constant, otherwise we would fail in the DCHECK in line 269.

Bug: v8:7700
Fixed: chromium:1395603
Change-Id: I3ce6dcb5e4e8e0040ef16fb3b3065ef7b86c7c36
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4088362
Commit-Queue: Patrick Thier <pthier@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84723}
2022-12-08 10:58:41 +00:00
Dominik Inführ
f5f735b10d [heap] Disable black allocation in shared heap during client GC
A scavenger GC can run on a client isolate while incremental marking
is enabled in the shared space isolate. While we pause black
allocation in the client's heap, we can't really pause it in the
shared heap isolate.

This CL solves that by marking ConcurrentAllocator instances created
for the GC. Black allocation is never enabled during GC. This will
probably also be useful when moving LABs out of the spaces.

Bug: v8:13267
Change-Id: Ie92848854c39229a8eca74cb07bd4be19a725ec8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4085503
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84722}
2022-12-08 10:54:57 +00:00
George Wort
a5ef6cd41d [turbolizer] Allow live ranges display to switch axes
Add the option to swap what is displayed on which
axis and increase the density in the horizontal axis
when displaying live ranges in turbolizer.

Bug: v8:7327
Change-Id: I47ac94d93942bdf760ad330a19f8f567078fd531
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4085144
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: George Wort <george.wort@arm.com>
Cr-Commit-Position: refs/heads/main@{#84721}
2022-12-08 10:44:17 +00:00
Liviu Rau
576d8f9418 [resultdb] Add more data about tests
Data added:
 - subtest_id as it is generated by Processors
 - processor_name to trace back the processors that generate subtests
 - path of the test
 - test_id suffixes introduced by processors:
   - numfuzz will have
     - an `analysis` suffix for analysis phase
     - a number suffix for the variants generated after analysis
   - variant processor adds a suffix for every variant
   - subtests will inherit suffixes from the parent tests (origin)

V8-Recipe-Flags: resultdb
Cq-Include-Trybots: luci.v8.try:v8_numfuzz_dbg,v8_numfuzz_rel,v8_numfuzz_tsan_compile_rel,v8_numfuzz_tsan_rel
Bug: v8:13316
Change-Id: I67d8b92b575c31b201238cfbcfc76cd076a2f7af
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4081127
Commit-Queue: Liviu Rau <liviurau@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84720}
2022-12-08 09:55:07 +00:00